Auth bypass in Github
CVE-2021-22862
An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference of a pull request to be updated to point to an arbitrary SHA or another pull request outside of the fork repository. By establishing this incorrect reference in a PR, the restrictions that limit the Actions secrets sent a workflow from forks could be bypassed. This vulnerability affected GitHub Enterprise Server version 3.0.0, 3.0.0.rc2, and 3.0.0.rc1. This vulnerability was reported via the GitHub Bug Bounty program.
EPSS: 0.008 (53.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Github — versions 3.0.0
- Github Enterprise Server — versions 3.0
Weakness classification (CWE)
References
- product-cna@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-22862?
- CVE-2021-22862 is a medium-severity vulnerability in Github, classified under Improper Authorization. CVSS score: 6.5/10. Published 2021-03-03.
- How severe is CVE-2021-22862?
- Medium severity. CVSS v3 base score is 6.5 out of 10.